Overview - Security Guide for OfficeServ system

Transcription

1 Overview - Security Guide for OfficeServ system Basic recommendation for all OfficeServ systems (Common) OS7000 Series (Except OS7200 MCP) : V4.65 or more Samsung Telecommunications America 1301 E. Lookout Drive Richardson, TX

2 OS7000 Series (Except OS7200 MCP) : From V4.60 to V4.63x OS7000 Series (Except OS7200 MCP) : From V4.22a to V4.53x OS7000 Series(Except OS7200 MCP) : Under V4.22a or OS500/100/12 & OS7200 MCP V1.0 Page 2 of 25

3 International Call Restriction by COS Setting for SIP Extension (1/3) 1. Menu : IT/DM (MMC301) Use COS level to restrict an international call for SIP extensions. Set all Ring Plan of SIP extension to 2. SIP Extension number V1.0 Page 3 of 25

4 International Call Restriction by COS Setting for SIP Extension (2/3) 2. Menu : IT/DM (MMC701) Change the Toll Level of COS for SIP extension to below B. Defalut Toll Level of COS 02 is B V1.0 Page 4 of 25

5 International Call Restriction by COS Setting for SIP Extension (3/3) 3. Menu : IT/DM (MMC702) List a prefix code (e.g.00x) for International call in the Toll Deny Table as below. Set the value to Yes V1.0 Page 5 of 25

6 Make All Slots for SIP Station Disable Menu : IT/DM (MMC857) If there is no use of SIP Station, change all virtual slots for SIP station to other types to avoid an illegal SIP user registration. V1.0 Page 6 of 25

7 Delete the Access Code (inc. LCR) Menu : IT/DM (MMC714) In case of Non-Tandem Use, delete the trunk number/access code including LCR from the menu or MMC714. Delete it, if 7*** is a trunk number. Delete LCR code V1.0 Page 7 of 25

8 V1.0 Page 8 of 25

9 IP White List DM (V4.65 or Later) Menu : DM Only the IP addresses listed here is allowed to access the system using DM. If there are no IP addresses in the list, then the system is fully open so any PC using DM can access the system. V1.0 Page 9 of 25

10 IP White List Phone (V4.65 or Later) Menu : DM (MMC875) Define IP addresses for the registration of Samsung IP phones, SIP Phones, PCs or Servers running CTI solutions and LAN Printers (DM 5.6.2). Registration to the system is permitted only for IP addresses listed here. [Exception] If <Use IP White List> of DM 2.7.1/ is set to <Disable>, the designated phone can register to the system although its IP address is not inputted in DM Phone IP White List. V1.0 Page 10 of 25

11 IP White List Management (V4.65 or Later) Menu : DM (MMC875) Define IP addresses for Telnet, FTP Server, and SMDR. System allows only the IP addresses defined here to access the system. V1.0 Page 11 of 25

12 IP White List IP Address Range Rule (V4.65 or Later) There are two ways to input DM/ Phone/ Management IP address. One is inputting each IP address to each entry. Another is inputting IP address range as below V1.0 Page 12 of 25

13 Make the 'Common Exclusive' Enable (V4.60 or Later) Menu : IT/DM (MMC837) Set the value of Common Exclusive option to No Response - No Response SIP INVITE MSG from outside unauthorized IP address will be ignored. And if the message happens repeatedly, the IP address will be blocked for a while. - Response For the SIP INVITE MSG from outside unauthorized IP address, the 403 Forbidden response will be followed. V1.0 Page 13 of 25

14 Make the 'Carrier Exclusive' Enable (V 4.22a ~ V4.53c) Menu : IT/DM (MMC837) Set the value of Carrier Exclusive to Enable. - Enable For the Invite Message from outside unauthorized IP address, the 403 Forbidden response will be followed. Enable it!! V1.0 Page 14 of 25

15 MMC832 IN/OUT Digit Translation (Under V4.22a) (1/3) Site : Non-Use of SIP Trunk/Peering Menu : IT/DM (MMC832) Except for the first digit of DID numbers for SIP incoming call, set the value of Access Digit and Insert Digit as below to block illegal SIP Peering call attempt. V1.0 Page 15 of 25

16 MMC832 IN/OUT Digit Translation (Under V4.22a) (2/3) Site : Main & Branch Office & PSTN trunk line into the main office only. Menu : IT/DM 5.2.4, (MMC832) SCHEME - When making a call from Branch to Main office, any 8 digits are added in front the calling number. And then if 8 digits appended is not same as the numbers main system has known, the call attempt will be denied as an illegal thing. 1. Branch Office : OUT Table DB Setting. Insert the trunk access digit and then put any 8 digits into Insert digit section. Put any 8 digits as you please V1.0 Page 16 of 25

17 V1.0 Page 17 of 25

18 MMC832 IN/OUT Digit Translation (Under V4.22a) (3/3) 2. Branch Office : IN Table DB Setting. Route a trunk access code to an opeartor or invalid number as below. Route a trunk access code to an operator or invalid number 3. Main Office : IN Table DB Setting. Insert the same number as Insert digit in BR OUT DB into Access Digit section and put the length of digit as below. Then, make the trunk access code routed to an operator or invalid number. Route a trunk access code to an operator or invalid number Set the Delete length as a length of password digits. V1.0 Page 18 of 25

19 V1.0 Page 19 of 25

20 Delete unused SVMi extensions & mailboxes (ALL) (1/3) SVMi creates many extensions and mailboxes defined in DM and DM You have to remove the extensions and mailboxes that are not used to prevent illegal use. 1. DM Set SVM Auto Setup to No. V1.0 Page 20 of 25

21 Delete unused SVMi extensions & mailboxes (ALL) (2/3) 2. DM Select None for each station that you do not want to create a subscriber for. V1.0 Page 21 of 25

22 Delete unused SVMi extensions & mailboxes (ALL) (3/3) 3. DM & Open Block Table Extension & Mailbox Delete the extensions and mailboxes that are not used. V1.0 Page 22 of 25

23 SVMi Outcall Authorization (ALL) (1/2) 1. Open Block Table EClass block Set Outcall Authorizations to No and remove all excepted area codes for all Eclass blocks. V1.0 Page 23 of 25

24 SVMi Outcall Authorization (ALL) (2/2) 2. Open Block Table MClass block Set Callback Authorizations to No and remove all excepted area codes for all Mclass blocks. Set Ports to use to None for Alert Message Notification and Delivery if you use SVMi-E series earlier than V or OS7100/OS7030/OS7070/OS7200S) earlier than V4.53. V1.0 Page 24 of 25

25 Change SVMi Admin Password (ALL) Change default passcode of System Admin to the other one. You can access SVMi DTMF administration with this passcode. V1.0 Page 25 of 25